日度归档：2020 年 06 月 27 日

LINUX

CentOS7日志管理工具journal

CentOS7的systemd使用journal来记录管理日志，journal记录的日志为二进制格式，可以通过管理工具维护。对应的服务为systemd-journald
你会发现在/var/log/下少了很多日志文件，而/var/log/journal占用了大量的磁盘空间

1、查看服务
[root@docker log]# systemctl status systemd-journald.service
● systemd-journald.service - Journal Service
Loaded: loaded (/usr/lib/systemd/system/systemd-journald.service; static; vendor preset: disabled)
Active: active (running) since 五 2020-06-26 03:38:23 UTC; 1 day 11h ago
Docs: man:systemd-journald.service(8)
man:journald.conf(5)
Main PID: 79 (systemd-journal)
Status: "Processing requests…"
Tasks: 1
Memory: 7.0M
CGroup: /system.slice/systemd-journald.service
└─79 /usr/lib/systemd/systemd-journald
6月 19 13:54:37 docker systemd-journal[77]: Journal stopped
6月 19 13:54:52 docker systemd-journal[77]: Runtime journal is using 8.0M (max allowed 307.2M, trying to leave 460.8M free of 2.9G available → current limit 307.2M).
6月 19 13:54:52 docker systemd-journal[77]: Journal started
6月 19 13:54:53 docker systemd-journal[77]: Permanent journal is using 328.0M (max allowed 4.0G, trying to leave 4.0G free of 74.2G available → current limit 4.0G).
6月 19 13:54:53 docker systemd-journal[77]: Time spent on flushing to /var is 56.281ms for 31 entries.
6月 26 03:38:12 docker systemd-journal[77]: Journal stopped
6月 26 03:38:23 docker systemd-journal[79]: Runtime journal is using 8.0M (max allowed 307.2M, trying to leave 460.8M free of 2.9G available → current limit 307.2M).
6月 26 03:38:23 docker systemd-journal[79]: Journal started
6月 26 03:38:24 docker systemd-journal[79]: Permanent journal is using 328.0M (max allowed 4.0G, trying to leave 4.0G free of 47.7G available → current limit 4.0G).
6月 26 03:38:24 docker systemd-journal[79]: Time spent on flushing to /var is 51.714ms for 22 entries.

2、查看使用磁盘空间
[root@docker log]# journalctl --disk-usage
Archived and active journals take up 336.0M on disk.

3、清理命令
格式：
journalctl --vacuum-size=BYTES：保留多大的日志
journalctl --vacuum-time=TIME：移除多久以前的日志
例子：
保留一周的日志
journalctl --vacuum-time=1w
保留500MB的日志
journalctl --vacuum-size=500M

4、查看当前日志
journalctl -f

5、查看指定应用日志
journalctl -xeu httpd

参考资料：
https://www.cnblogs.com/leigepython/p/10302056.html